The systemd units can also provide an extra layer of security. You can add several options to your unit file to make your unit more secure.
Just edit the unit file using systemctl --edit and add the security measures. For instance, execute the following:
sudo systemctl --edit sshd
Add the following lines:
[Service]
ProtectHome=read-only
Save the file, reread the systemctl configuration, and restart sshd:
sudo systemctl daemon-reload
sudo systemctl restart sshd
Now log in again with your SSH client and try to save a file in your home. It will fail because it's a read-only filesystem:
